802.1x with Vlan assignment and IP phone and PC

I have a Catalyst 4510R and I want to im plement 802.1x with dynamic VLAN assignment via Radius server. I am going to plug to switch ports Cisco IP phones and PCs (PCs are plugged in the IP phone).
For this implementation I need to configure the switch port in mode trunk because I have voice vlan corresponding IP phone and data vlan corresponding to PC.
However I have read that I can not enable 802.1x on a trunk port.
How could I configure this?
I need that when the PC is authenticated correctly is assigned to his cooresponding data vlan and the IP phone is in the voice vlan.
Thanks

You should configure the port as an access port with an aux-vlan. Here's an example:
interface GigabitEthernet2/2
switchport access vlan 701
switchport mode access
switchport voice vlan 702
load-interval 30
qos trust device cisco-phone
qos trust cos
auto qos voip cisco-phone
dot1x pae authenticator
dot1x port-control auto
tx-queue 3
bandwidth percent 33
priority high
shape percent 33
spanning-tree portfast
spanning-tree bpduguard enable
service-policy output autoqos-voip-policy
Hope this helps,

Similar Messages

  • 802.1x with VLAN assignment on Catalyst 2950T-48-SI

    I will really appreciate if you can confirm me if the C2950T-48-SI will support the following features.
    - IEEE 802.1x with VLAN assignment
    - SSHv2
    - SNMPv3
    The data sheet for the Cisco Catalyst 2950 Series Switches with Standard Image mentions all the above and more features for the 2950T-48-SI, but at the same time the power point presentation, (Cisco Catalyst 2950 Series Switches, and the tool Sofware advisor say that those features are only supported with the Enhanced Image.
    If your those feature are supported by the Standard Image, would you please also inform the last IOS version supported.
    Thanks a lot.

    SSH isn't available on the SI version of the 2950 as you require the Crypto features and these are not available for the SI (the documentation is a little vague here but trust me I have upgraded one and it doesn't like it...). The documentation says 'Switches that support only the SI cannot run the cryptographic image.'
    802.1x with VLAN assignment is available only in the latest IOS - or at least since 12.1(22).
    SNMPv3 is supported.
    HTH
    Andy

  • 871 802.1x with vlan assignment aka dynamic vlan

    you can do vlan assignment on 871W wireless using the local radius server but unfort only LEAP which is N.G.
    I have been pounding on wired 802.1x PEAP (which works) trying to get vlan re-assignment. Have tried with IAS which I am using to do vlan reassignment with the WLC so I have the idea of how it works with IAS. With 871, no go. Have also tried ACS for radius with same results: can't escape the switchport's vlan. With debug radius local you can see the tunnel attributes for reassignment plainly but with debug radius with IAS or ACS, nada.
    Using 12.4(6)T advanced IP.
    I have just seen that 12.4(4)CX2 has "802.1x with vlan reassignment" but the download is MIA. Wonder what's up with that?
    Has anybody got this to work? Any info much appreciated
    Greg Turner

    SSH isn't available on the SI version of the 2950 as you require the Crypto features and these are not available for the SI (the documentation is a little vague here but trust me I have upgraded one and it doesn't like it...). The documentation says 'Switches that support only the SI cannot run the cryptographic image.'
    802.1x with VLAN assignment is available only in the latest IOS - or at least since 12.1(22).
    SNMPv3 is supported.
    HTH
    Andy

  • WoL over 802.1X with Vlan Assignement

    Hello
    I have a switch 3560, and an ACS v4
    In phase of test i have an infrastructure with 802.1X PEAP with automatic VLAN assignation by the ACS according to the Machine.
    My question is:
    it possible to implement Wake One Lan on 802.1x with a assigantion of vlan not statics (i.e. without use of command Switchport access vlan XXX)
    PS: if I do in statics the VLAN on a port Wake one Lan work without Pb with 802.1X

    Ok, on interface 0/19 :
    Switchport mode access
    speed 100
    duplex Full
    dot1x pae authenticator
    dot1x port-control auto
    dot1x control-direction in
    spanning-tree portfast
    The software use is like "wolcmd" with configuration of
    MAC address of the PC
    IP of the PC (give by DHCP reservation)
    Subnet mask
    Remote port Number : 7
    The authentication on ACS work fine and on ACS whe have this field
    [064] Tunnel-Type
    value : VLAN
    [065] Tunnel-Medium-Type
    Value : 802.
    [Tunnel-Private-Group-ID]
    Value : 69
    In fact, the only difference between config is assignation static or dynamic of VLAN
    I don't know if this what you wan't
    thanks

  • 802.1x with VLAN assignment through MS IAS radius

    What is the correct input syntax of the cisco VAS at the MS IAS?
    Cisco Vendor ID = 9
    - [64] Tunnel-Type = VLAN
    - [65] Tunnel-Medium-Type = 802
    - [81] Tunnel-Private-Group-ID = VLAN NAME
    Thanks

    Not sure of this but this link could be of some help : http://www.microsoft.com/windows2000/technologies/communications/ias/

  • I have an itunes account on my home PC. I want to use my same account but on my laptop. How do i do this with out wiping out my phone and backing up all my Pictures and Apps? Please Help.

    I have an itunes account on my home PC. I want to use my same account but on my laptop. How do i do this with out wiping out my phone and backing up all my Pictures and Apps? Please Help.

    Copy everything from the old computer or your backup copy of your old computer to your new one.
    Type "move itunes library from pc to mac" or similar into the google search bar.

  • When I try to use 'Stacked Column Bar'. with data assigned in the graphs, and want to see it in the 'Preview' mode in Xeclsius, I unable to see the graphs apart from the Axes ans Series Value, the graphs becomes totaly invisible why So ?

    When I try to use 'Stacked Column Bar'. with data assigned in the graphs, and want to see it in the 'Preview' mode in Xeclsius, I unable to see the graphs apart from the Axes ans Series Value, the graphs becomes totally invisible why So ?

    Hi Ranendra,
    For basic understanding of Dashboards and Models you can use standard Templates or samples which ll come along with dashboard designer(Formly Xcelsius) installation.
    For path   File-->Templates(or Samples).
    Under Templates you ll have different categories and for each you ll find the dashboard Templates.
    Regards,
    Venkat P

  • HT1695 my iphone wont find wifi anymore, in settings the wifi button is off and it won't turn on.  tried resetting and erasing phone and it still doesn't work.  ???

    my iphone wont find wifi anymore, in settings the wifi button is off and it won't turn on.  tried resetting and erasing phone and it still doesn't work.  ???

    Follow all the steps in the article below:
    http://support.apple.com/kb/ts1559
    If the issue remains it would be best for you to back up your phone then book an appointment at an Apple Retail Store to be evaluated.
    Hope this helps

  • 802.1x dynamic VLAN assignment with Radius NPS Server

    I can NOT get the NPS and Cisco 3550 switch to drop the authenticated user in a VLAN.
    I have followed this documentation,
    http://msdn.microsoft.com/en-us/library/dd314181(v=ws.10).aspx
    that basically says to use these Radius attributes,
    Tunnel-Medium-Type : 802
    Tunnel-Pvt-Group-ID  :  My_VLAN_Number  (also tried VLAN name)
    Tunnel-Type  : VLAN
    There is some Cisco documentation that says to use Vendor Specific attributes Cisco-AV-Pair,
    http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swauthen.html#wpxref83693
    and I have also tried that,
    cisco-avpair= "tunnel-type(#64)=VLAN(13)"
    cisco-avpair= "tunnel-medium-type(#65)=802 media(6)"
    cisco-avpair= "tunnel-private-group-ID(#81)=vlanid"
    My user authenticates on the port fine, but doesn't get put into a VLAN.  If I add "sw acc vlan 110"  then the user authenticates and then does get an IP address in that VLAN and all is well.
    Anybody know how to get dynamic VLAN assignment working with NPS?
    NPS on Win 2012 R2
    Domain controller separate Win 2012 R2 server
    Cisco 3550 switch

    Hi All, Can any one guide me to
    configure 802.1x with acs 5.0. Its totally new look and m not able to
    find document related to 802.1x.Thanks
    Hi,
    Check out the below link on how to configure 802.1x and ACS administration hope to help !!
    http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
    Ganesh.H

  • 802.1x dynamic vlan assignment with acs5.0

    Hi All, Can any one guide me to configure 802.1x with acs 5.0. Its totally new look and m not able to find document related to 802.1x.
    Thanks

    Hi All, Can any one guide me to
    configure 802.1x with acs 5.0. Its totally new look and m not able to
    find document related to 802.1x.Thanks
    Hi,
    Check out the below link on how to configure 802.1x and ACS administration hope to help !!
    http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
    Ganesh.H

  • 802.1x dynamic vlan assignment using ACS 4.2

    Hi
    we have 10 switches 2960 configured with 802.1x authentication against ACS server 4.2.
    we have 2 vlans configured on the switches for administrator and endusers. the end user vlan id is 10 and the administartor vlan is is 100.
    we need to apply the following scenario, if the enduser PC - that is connected to vlan 10 - has an issue and the administrator will login to the PC with the administrator account to fix that issue, the switch should dynamically reconfigure the port with the administrator vlan ( 100 ) .
    is the above scenario doable using dot1x with the ACS server?
    waiting your replies
    Mohamed

    Hi,
    I have the following scenario
    2 bulidings with multiple floor
    Each floor should be in different VLAN.
    The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
    Each
    user should be able to connect and roam around between any building.
    when ever a user is connecting his laptop to any floor, he should be
    made part of that respective vlan. It is not requred to have the same
    IP rage to be allocated, but the dynamic VLAN should be based on the
    switch port location.
    Can
    I configure ACS in such a way that, the ACS will allocate dynamic VLAN
    for every 802.1x authentication  based on the Network Device Group.
    Please refer the attached diagram
    Hi,
    Check out the below link for your requirement for dynamic vlan assignement using ACS
    http://www.ciscosystems.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml
    Hope to Help !!
    Ganesh.H
    Remember to rate the helpful post

  • 802.1x Dynamic Vlan assignment using ACS

    Hi,
    I have the following scenario
    2 bulidings with multiple floor
    Each floor should be in different VLAN.
    The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
    Each user should be able to connect and roam around between any building. when ever a user is connecting his laptop to any floor, he should be made part of that respective vlan. It is not requred to have the same IP rage to be allocated, but the dynamic VLAN should be based on the switch port location.
    Can I configure ACS in such a way that, the ACS will allocate dynamic VLAN for every 802.1x authentication  based on the Network Device Group. Please refer the attached diagram

    Hi,
    I have the following scenario
    2 bulidings with multiple floor
    Each floor should be in different VLAN.
    The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
    Each
    user should be able to connect and roam around between any building.
    when ever a user is connecting his laptop to any floor, he should be
    made part of that respective vlan. It is not requred to have the same
    IP rage to be allocated, but the dynamic VLAN should be based on the
    switch port location.
    Can
    I configure ACS in such a way that, the ACS will allocate dynamic VLAN
    for every 802.1x authentication  based on the Network Device Group.
    Please refer the attached diagram
    Hi,
    Check out the below link for your requirement for dynamic vlan assignement using ACS
    http://www.ciscosystems.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml
    Hope to Help !!
    Ganesh.H
    Remember to rate the helpful post

  • 802.1X dyanmic VLAN assignment DHCP issue (Vista client)

    I am labbing dynamic VLAN assignment and have run into a small problem.  The switchport is succesfully changing to the new VLAN, but my test PC seems to get an IP address in the native data VLAN before being moved to the new dynamic assigned VLAN.  So when the switch changes the VLAN the PC keeps its old IP address and nothing talks any more.
    Is this a Vista issue?  I thought all of these problems were just issues in XP?  Do I need to tweak any interface dot1x timers?
    (Cat3750 with 12.2.55 / ACS5.1.  Everything else is running fine by the way.)

    if i do a show run on the switchport the config hasnt changed, but i dont expect it to, as its not a permanent config change that you would want to be saved by a different admin user saving the config.  You can see the debug report it is changing the VLAN:
    Apr 19 09:22:56.263: %AUTHMGR-5-START: Starting 'dot1x' for client (0014.c209.896f) on Interface Gi1/0/19 AuditSessionID C0A8FE250000000900291476
    Apr 19 09:22:58.604: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/19, changed state to up
    Apr 19 09:22:59.560: %DOT1X-5-SUCCESS: Authentication successful for client (0014.c209.896f) on Interface Gi1/0/19 AuditSessionID
    Apr 19 09:22:59.568: %AUTHMGR-5-VLANASSIGN: VLAN 12 assigned to Interface Gi1/0/19 AuditSessionID C0A8FE250000000900291476
    Apr 19 09:22:59.585: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan12, changed state to up
    Apr 19 09:23:00.307: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/19, changed state to up
    Apr 19 09:23:00.315: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0014.c209.896f) on Interface Gi1/0/19 AuditSessionID C0A8FE250000000900291476
    as well as checking with the show int switchport command and it is in v12 which is the dynamically assigned vlan
    DHCP server is the cat3750 for all local VLANs

  • Help needed with contact/groups synching between phone and laptop via cloud

    I installed OS X 10.7.5 and my software is up to date on both my I-phone and my MacBook. I have the cloud enabled. But now, when I try to access my contact groups on my I-phone, I just get the list of groups with checks beside them; I can't select a group and have those contacts displayed as they were
    prior to installing the updates. I have cloud enabled and can see the groups displated when I go to the cloud.com site. But how do I get my iphone to display contacts by groups again? If I click on "Done" with all contacts and all groups checked, the display goes out of the groups category and back to the
    list of all contacts. Do I need to change something in settings? At present, when USB-connected to the Mac and in I-tunes and looking at "information"
    for my Iphone, I don't have synch contacts selected. I thought synching was happening via the cloud. I didn't make any change in that I-tunes synch setting
    compared with before installing the new operating system and updating the rest of my software. If I need to check "synch contacts," do I check synch all
    contacts or the box for synching groups. I want to have all my contacts and all group organization that's on my computer duplicated on my phone and would like to have synching happen without having to physically connect the phone to my computer.  Help would be appreciated!

    http://www.apple.com/business/theater/#managegroupsofcontacts
    Download the "Groups" app from the app store.  It is free. 

  • If apple app store has an app to sync windows phone with itunes called windows connector, and windows phone and apple are competitors, why doesnt apple make an app for android that syncs itunes without a third party software

    I want to simply sync my android and my mac itunes without downloading any software. Windows phone has an app to do that even though apple and windows phone are competitors. Why does android not make an app or why doesnt apple create an software or something

    Apple didn't create the Windows Phone app (Microsoft). Apple has nothing to do with this, and Google should do an app for this

Maybe you are looking for